CVE-2024-43360

Public Exploit
ZoneMinder Time-based SQL Injection

Description

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61.

Category

9.8
CVSS
Severity: Critical
CVSS 3.1 •
EPSS 55.17% Top 5%
Vendor Advisory github.com
Affected: ZoneMinder zoneminder
Published at:
Updated at:

References

Link Tags
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj vendor advisory exploit
https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a patch
https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 patch
https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 patch
https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5 patch

Frequently Asked Questions

What is the severity of CVE-2024-43360?
CVE-2024-43360 has been scored as a critical severity vulnerability.
How to fix CVE-2024-43360?
To fix CVE-2024-43360, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-43360 being actively exploited in the wild?
It is possible that CVE-2024-43360 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~55% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-43360?
CVE-2024-43360 affects ZoneMinder zoneminder.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.